A 'secret' domain name as a principal PBX security measure

[Stewart1 (Stewart)]

@xrobau

It takes, on average, about 6 hours for a new sip server, appearing anywhere on the internet to start to get scanned. This has nothing to do with DNS, this has to do with many many attackers continuously scanning every IP address on the internet for devices responding on port 5060.

We were discussing TLS, as would be used to protect assets such as the FreePBX admin GUI, UCP and provisioning. SIP UDP is protected differently, with two iptables rules: one that accepts packets containing the domain name, and one that accepts ‘established’ and ‘related’ packets. See

PBX Security

I have a system running with a very simple firewall. Everything not explicitly permitted is dropped. FreePBX firewall is not used. Chain INPUT (policy DROP) num target prot opt in out source destination 1 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 3 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 4 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:10000:20000 5 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:…

Now, I admit that the TLS case would be vulnerable to an Apache bug that allowed an unauthenticated attacker to take over a dummy site that always returned a 403, or an iptables bug that allowed an attacker to bypass an arbitrary rule. However, such bugs would not be limited to PBXes and would affect all linux servers, perhaps 100 million machines, and would be quickly publicized and patched.